{"record":{"id":"e326ca88a2a8db69","repo":"risingwavelabs/risingwave","slug":"unsupported-ssl-mode","errorCode":null,"errorMessage":"unsupported SSL mode","messagePattern":"unsupported SSL mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/connector/src/source/cdc/external/mysql.rs","lineNumber":145,"sourceCode":"    column_descs: Vec<ColumnDesc>,\n    pk_names: Vec<String>,\n}\n\nimpl MySqlExternalTable {\n    pub async fn connect(config: ExternalTableConfig) -> ConnectorResult<Self> {\n        tracing::debug!(\"connect to mysql\");\n        let options = MySqlConnectOptions::new()\n            .username(&config.username)\n            .password(&config.password)\n            .host(&config.host)\n            .port(config.port.parse::<u16>().unwrap())\n            .database(&config.database)\n            .ssl_mode(match config.ssl_mode {\n                SslMode::Disabled => sqlx::mysql::MySqlSslMode::Disabled,\n                SslMode::Preferred => sqlx::mysql::MySqlSslMode::Preferred,\n                SslMode::Required => sqlx::mysql::MySqlSslMode::Required,\n                _ => {\n                    return Err(anyhow!(\"unsupported SSL mode\").into());\n                }\n            });\n\n        let connection = MySqlPool::connect_with(options).await?;\n        let mut schema_discovery = SchemaDiscovery::new(connection, config.database.as_str());\n\n        // discover system version first\n        let system_info = schema_discovery.discover_system().await?;\n        schema_discovery.query = SchemaQueryBuilder::new(system_info.clone());\n        let schema = Alias::new(config.database.as_str()).into_iden();\n        let table = Alias::new(config.table.as_str()).into_iden();\n        let columns = schema_discovery\n            .discover_columns(schema.clone(), table.clone(), &system_info)\n            .await?;\n        let indexes = schema_discovery.discover_indexes(schema, table).await?;\n        let mut column_descs = vec![];\n        for col in columns {\n            let data_type = mysql_type_to_rw_type(&col.col_type)?;","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/source/cdc/external/mysql.rs#L127-L163","documentation":"RisingWave's MySQL CDC connector only accepts a fixed set of SSL modes when building the sqlx MySQL connection pool. The user-supplied cdc_source.ssl_mode value did not map to Disabled, Preferred, or Required, so connect() rejects it before any network I/O. This guards against silently downgrading or misconfiguring TLS for the CDC source.","triggerScenarios":"Creating a CDC table with WITH ssl_mode set to a value other than 'disabled', 'preferred', or 'required' (e.g. 'verify-ca', 'verify-full', 'true', or a misspelled variant).","commonSituations":"Copy-pasting Postgres-style ssl_mode values (verify-ca/verify-full) into a MySQL CDC connection; enabling TLS docs from another driver; typos like 'require' or case differences.","solutions":["Change the ssl_mode option in the WITH clause to one of: 'disabled', 'preferred', 'required'.","Check the RisingWave docs for the exact accepted ssl_mode strings for mysql cdc sources.","If stronger validation (verify-ca/verify-full) is needed, request/track upstream support; it is not implemented in this code path."],"exampleFix":"// before\nCREATE TABLE t (...) WITH (\n  connector = 'mysql-cdc',\n  ssl_mode = 'verify-full'\n);\n// after\nCREATE TABLE t (...) WITH (\n  connector = 'mysql-cdc',\n  ssl_mode = 'required'\n);","handlingStrategy":"validation","validationCode":"const VALID_MODES = [\"disabled\", \"preferred\", \"required\"];\nif (!VALID_MODES.includes(options.ssl_mode?.toLowerCase())) {\n  throw new Error(`ssl_mode must be one of ${VALID_MODES.join(\"/\")}, got: ${options.ssl_mode}`);\n}","typeGuard":"function isValidSslMode(m) { return [\"disabled\",\"preferred\",\"required\"].includes(String(m).toLowerCase()); }","tryCatchPattern":"try { await createCdcTable({...options, ssl_mode: 'required'}); } catch (e) { if (String(e).includes('unsupported SSL mode')) { /* fix ssl_mode and retry */ } else throw e; }","preventionTips":["Only use ssl_mode values documented for mysql-cdc: disabled/preferred/required","Never copy Postgres ssl_mode values into MySQL CDC options","Validate the WITH clause options against the connector docs before DDL"],"tags":["cdc","mysql","ssl","configuration"],"backgroundTag":"invalid-enum-value","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}